firewall: add installation mechanism